By Stein Ove Helset, Obot AI
Grabbing an MCP server off GitHub and pasting the config into Cursor takes about two minutes. For local testing, that's probably fine. For production — or sharing it to your whole team — it's a different story entirely.
An MCP server is code that runs with your credentials, and the AI will call it whenever it decides to. Before that happens in production, there are a few things worth checking: Who actually built and maintains it? What can the tools do beyond what the README says? How does it handle credentials? What's in its dependency tree, and does it behave the way you expect in a sandbox before it's live?
This is a practical walkthrough of what to actually check — including the specific code patterns to look for in Python and TypeScript tool definitions, how to use npm audit and pip-audit on the lockfile, and what running it in a sandbox for a day or two can tell you before you commit.
Vetting gets the server in the door. This post also covers what comes next: keeping it within those boundaries once it's live and the tools and dependencies start changing.
⏱ 7-minute read · 📓 Full article
Originally published on Obot AI
Top comments (0)